Diff
Modified: trunk/LayoutTests/ChangeLog (111358 => 111359)
--- trunk/LayoutTests/ChangeLog 2012-03-20 05:24:24 UTC (rev 111358)
+++ trunk/LayoutTests/ChangeLog 2012-03-20 05:29:11 UTC (rev 111359)
@@ -1,3 +1,19 @@
+2012-03-19 Pablo Flouret <[email protected]>
+
+ Add support for crossorigin attribute in script elements
+ https://bugs.webkit.org/show_bug.cgi?id=81438
+
+ Reviewed by Adam Barth.
+
+ * http/tests/security/resources/alert-fail.js: Added.
+ * http/tests/security/resources/cors-script.php: Added.
+ * http/tests/security/script-crossorigin-loads-correctly-expected.txt: Added.
+ * http/tests/security/script-crossorigin-loads-correctly.html: Added.
+ * http/tests/security/script-crossorigin-loads-same-origin-expected.txt: Added.
+ * http/tests/security/script-crossorigin-loads-same-origin.html: Added.
+ * http/tests/security/script-with-failed-cors-check-fails-to-load-expected.txt: Added.
+ * http/tests/security/script-with-failed-cors-check-fails-to-load.html: Added.
+
2012-03-19 Anders Carlsson <[email protected]>
plugins/application-plugin-plugins-disabled.html should be a Qt specific test
Added: trunk/LayoutTests/http/tests/security/resources/alert-fail.js (0 => 111359)
--- trunk/LayoutTests/http/tests/security/resources/alert-fail.js (rev 0)
+++ trunk/LayoutTests/http/tests/security/resources/alert-fail.js 2012-03-20 05:29:11 UTC (rev 111359)
@@ -0,0 +1 @@
+alert("FAIL");
Added: trunk/LayoutTests/http/tests/security/resources/cors-script.php (0 => 111359)
--- trunk/LayoutTests/http/tests/security/resources/cors-script.php (rev 0)
+++ trunk/LayoutTests/http/tests/security/resources/cors-script.php 2012-03-20 05:29:11 UTC (rev 111359)
@@ -0,0 +1,5 @@
+<?php
+header("Access-Control-Allow-Origin: http://127.0.0.1:8000");
+header("Content-Type: application/_javascript_");
+?>
+alert("script ran.");
Added: trunk/LayoutTests/http/tests/security/script-crossorigin-loads-correctly-expected.txt (0 => 111359)
--- trunk/LayoutTests/http/tests/security/script-crossorigin-loads-correctly-expected.txt (rev 0)
+++ trunk/LayoutTests/http/tests/security/script-crossorigin-loads-correctly-expected.txt 2012-03-20 05:29:11 UTC (rev 111359)
@@ -0,0 +1,4 @@
+ALERT: script ran.
+This test passes if the script loads correctly.
+
+PASS
Added: trunk/LayoutTests/http/tests/security/script-crossorigin-loads-correctly.html (0 => 111359)
--- trunk/LayoutTests/http/tests/security/script-crossorigin-loads-correctly.html (rev 0)
+++ trunk/LayoutTests/http/tests/security/script-crossorigin-loads-correctly.html 2012-03-20 05:29:11 UTC (rev 111359)
@@ -0,0 +1,22 @@
+<body>
+<p>This test passes if the script loads correctly.</p>
+<pre></pre>
+<script>
+if (window.layoutTestController) {
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+}
+
+function done(msg) {
+ document.querySelector("pre").innerHTML = msg;
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+}
+
+var script = document.createElement("script");
+script.crossOrigin = "";
+script.src = ""
+script._onload_ = function() { done("PASS"); }
+script._onerror_ = function() { done("FAIL");}
+document.body.appendChild(script);
+</script>
Added: trunk/LayoutTests/http/tests/security/script-crossorigin-loads-same-origin-expected.txt (0 => 111359)
--- trunk/LayoutTests/http/tests/security/script-crossorigin-loads-same-origin-expected.txt (rev 0)
+++ trunk/LayoutTests/http/tests/security/script-crossorigin-loads-same-origin-expected.txt 2012-03-20 05:29:11 UTC (rev 111359)
@@ -0,0 +1,3 @@
+Test that a script element with a crossorigin attribute loads same-origin scripts correctly when there's no access control headers in the response.
+
+PASS
Added: trunk/LayoutTests/http/tests/security/script-crossorigin-loads-same-origin.html (0 => 111359)
--- trunk/LayoutTests/http/tests/security/script-crossorigin-loads-same-origin.html (rev 0)
+++ trunk/LayoutTests/http/tests/security/script-crossorigin-loads-same-origin.html 2012-03-20 05:29:11 UTC (rev 111359)
@@ -0,0 +1,16 @@
+<p>Test that a script element with a crossorigin attribute loads same-origin scripts correctly when there's no access control headers in the response.</p>
+<pre>FAIL</pre>
+<script>
+if (window.layoutTestController) {
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+}
+
+function loaded() {
+ document.querySelector("pre").innerHTML = "PASS";
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+}
+</script>
+<!-- This script should load -->
+<script crossorigin="anonymous" src="" _onload_="loaded()"></script>
Added: trunk/LayoutTests/http/tests/security/script-with-failed-cors-check-fails-to-load-expected.txt (0 => 111359)
--- trunk/LayoutTests/http/tests/security/script-with-failed-cors-check-fails-to-load-expected.txt (rev 0)
+++ trunk/LayoutTests/http/tests/security/script-with-failed-cors-check-fails-to-load-expected.txt 2012-03-20 05:29:11 UTC (rev 111359)
@@ -0,0 +1,4 @@
+CONSOLE MESSAGE: Cross-origin script load denied by Cross-Origin Resource Sharing policy.
+This test passes if the script does not load.
+
+PASS
Added: trunk/LayoutTests/http/tests/security/script-with-failed-cors-check-fails-to-load.html (0 => 111359)
--- trunk/LayoutTests/http/tests/security/script-with-failed-cors-check-fails-to-load.html (rev 0)
+++ trunk/LayoutTests/http/tests/security/script-with-failed-cors-check-fails-to-load.html 2012-03-20 05:29:11 UTC (rev 111359)
@@ -0,0 +1,22 @@
+<body>
+<p>This test passes if the script does not load.</p>
+<pre></pre>
+<script>
+if (window.layoutTestController) {
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+}
+
+function done(msg) {
+ document.querySelector("pre").innerHTML = msg;
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+}
+
+var script = document.createElement("script");
+script.crossOrigin = "";
+script.src = ""
+script._onload_ = function() { done("FAIL"); }
+script._onerror_ = function() { done("PASS");}
+document.body.appendChild(script);
+</script>
Modified: trunk/Source/WebCore/ChangeLog (111358 => 111359)
--- trunk/Source/WebCore/ChangeLog 2012-03-20 05:24:24 UTC (rev 111358)
+++ trunk/Source/WebCore/ChangeLog 2012-03-20 05:29:11 UTC (rev 111359)
@@ -1,3 +1,26 @@
+2012-03-19 Pablo Flouret <[email protected]>
+
+ Add support for crossorigin attribute in script elements
+ https://bugs.webkit.org/show_bug.cgi?id=81438
+
+ Reviewed by Adam Barth.
+
+ Works similarly to img and its crossorigin attribute. In the future it
+ could allow for things like showing full error messages in error
+ handlers, etc.
+
+ Tests: http/tests/security/script-crossorigin-loads-correctly.html
+ http/tests/security/script-crossorigin-loads-same-origin.html
+ http/tests/security/script-with-failed-cors-check-fails-to-load.html
+
+ * dom/ScriptElement.cpp:
+ (WebCore::ScriptElement::ScriptElement):
+ (WebCore::ScriptElement::requestScript):
+ (WebCore::ScriptElement::notifyFinished):
+ * dom/ScriptElement.h:
+ (ScriptElement):
+ * html/HTMLScriptElement.idl:
+
2012-03-19 Benjamin Poulain <[email protected]>
Do not copy the script source in the SourceProvider, just reference the existing string
Modified: trunk/Source/WebCore/dom/ScriptElement.cpp (111358 => 111359)
--- trunk/Source/WebCore/dom/ScriptElement.cpp 2012-03-20 05:24:24 UTC (rev 111358)
+++ trunk/Source/WebCore/dom/ScriptElement.cpp 2012-03-20 05:29:11 UTC (rev 111359)
@@ -27,6 +27,7 @@
#include "CachedScript.h"
#include "CachedResourceLoader.h"
#include "ContentSecurityPolicy.h"
+#include "CrossOriginAccessControl.h"
#include "Document.h"
#include "DocumentParser.h"
#include "Frame.h"
@@ -40,6 +41,7 @@
#include "ScriptRunner.h"
#include "ScriptSourceCode.h"
#include "ScriptValue.h"
+#include "SecurityOrigin.h"
#include "Settings.h"
#include "Text.h"
#include <wtf/StdLibExtras.h>
@@ -65,6 +67,7 @@
, m_willExecuteWhenDocumentFinishedParsing(false)
, m_forceAsync(!parserInserted)
, m_willExecuteInOrder(false)
+ , m_requestUsesAccessControl(false)
{
ASSERT(m_element);
}
@@ -245,7 +248,15 @@
ASSERT(!m_cachedScript);
if (!stripLeadingAndTrailingHTMLSpaces(sourceUrl).isEmpty()) {
- ResourceRequest request(m_element->document()->completeURL(sourceUrl));
+ ResourceRequest request = ResourceRequest(m_element->document()->completeURL(sourceUrl));
+
+ String crossOriginMode = m_element->fastGetAttribute(HTMLNames::crossoriginAttr);
+ if (!crossOriginMode.isNull()) {
+ m_requestUsesAccessControl = true;
+ StoredCredentials allowCredentials = equalIgnoringCase(crossOriginMode, "use-credentials") ? AllowStoredCredentials : DoNotAllowStoredCredentials;
+ updateRequestForAccessControl(request, m_element->document()->securityOrigin(), allowCredentials);
+ }
+
m_cachedScript = m_element->document()->cachedResourceLoader()->requestScript(request, scriptCharset());
m_isExternalScript = true;
}
@@ -303,10 +314,21 @@
cachedScript->removeClient(this);
}
-void ScriptElement::notifyFinished(CachedResource* o)
+void ScriptElement::notifyFinished(CachedResource* resource)
{
ASSERT(!m_willBeParserExecuted);
- ASSERT_UNUSED(o, o == m_cachedScript);
+ ASSERT_UNUSED(resource, resource == m_cachedScript);
+
+ if (m_requestUsesAccessControl
+ && !m_element->document()->securityOrigin()->canRequest(m_cachedScript->response().url())
+ && !m_cachedScript->passesAccessControlCheck(m_element->document()->securityOrigin())) {
+
+ dispatchErrorEvent();
+ DEFINE_STATIC_LOCAL(String, consoleMessage, ("Cross-origin script load denied by Cross-Origin Resource Sharing policy."));
+ m_element->document()->addConsoleMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage);
+ return;
+ }
+
if (m_willExecuteInOrder)
m_element->document()->scriptRunner()->notifyScriptReady(this, ScriptRunner::IN_ORDER_EXECUTION);
else
Modified: trunk/Source/WebCore/dom/ScriptElement.h (111358 => 111359)
--- trunk/Source/WebCore/dom/ScriptElement.h 2012-03-20 05:24:24 UTC (rev 111358)
+++ trunk/Source/WebCore/dom/ScriptElement.h 2012-03-20 05:29:11 UTC (rev 111359)
@@ -101,6 +101,7 @@
bool m_willExecuteWhenDocumentFinishedParsing : 1;
bool m_forceAsync : 1;
bool m_willExecuteInOrder : 1;
+ bool m_requestUsesAccessControl : 1;
String m_characterEncoding;
String m_fallbackCharacterEncoding;
};
Modified: trunk/Source/WebCore/html/HTMLScriptElement.idl (111358 => 111359)
--- trunk/Source/WebCore/html/HTMLScriptElement.idl 2012-03-20 05:24:24 UTC (rev 111358)
+++ trunk/Source/WebCore/html/HTMLScriptElement.idl 2012-03-20 05:29:11 UTC (rev 111359)
@@ -28,5 +28,6 @@
attribute [Reflect] boolean defer;
attribute [Reflect, URL] DOMString src;
attribute [Reflect] DOMString type;
+ attribute [Reflect] DOMString crossOrigin;
};
}
